@mutmutco/cli 3.32.0 → 3.33.0

package/dist/main.cjs

@@ -3520,7 +3520,10 @@ async function cleanExit(code) {
   await new Promise((resolve5) => setImmediate(resolve5));
   process.exit(code);
 }
-var CLI_EXIT_WATCHDOG_MS = 1e4;
+var CLI_EXIT_WATCHDOG_MS = (() => {
+  const testOverride = Number(process.env.MMI_CLI_TEST_EXIT_WATCHDOG_MS);
+  return process.env.NODE_ENV === "test" && Number.isFinite(testOverride) && testOverride >= 25 ? testOverride : 1e4;
+})();
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
   const timer = setTimeout(() => {
     console.error(
@@ -4928,7 +4931,8 @@ function retriedFetch(deps, url, init) {
   const headers = { ...clientVersionHeaders(), ...init.headers };
   return fetchWithRetry(deps.fetch ?? fetch, url, { ...init, headers }, {
     attempts: RETRY_ATTEMPTS,
-    timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS
+    timeoutMs: deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS,
+    sleep: deps.retrySleep
   });
 }
 async function fetchTrainAuthority(repo, deps) {
@@ -4992,23 +4996,6 @@ async function fetchProjectBySlug(slug, deps) {
   const res = await fetchProjectBySlugChecked(slug, deps);
   return res.ok ? res.project : null;
 }
-async function fetchDeployStatusBySlug(slug, deps) {
-  if (!deps.baseUrl || !slug) return null;
-  const token = await deps.token();
-  if (!token) return null;
-  try {
-    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}/deploy-status`, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    if (!body?.stages) return null;
-    return { stages: body.stages, deployState: body.deployState ?? {} };
-  } catch {
-    return null;
-  }
-}
 async function fetchDeployFactsBySlug(slug, deps) {
   if (!deps.baseUrl || !slug) return null;
   const token = await deps.token();
@@ -5079,8 +5066,8 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
   const token = await deps.token();
   if (!token) return { ok: false, status: 0, body: null, error: "no Hub session token (run `gh auth login`)" };
   const timeoutMs = opts.timeoutMs ?? deps.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS;
-  const sendOnce = (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: 1, timeoutMs });
-  const send = opts.noRetry ? sendOnce : (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: RETRY_ATTEMPTS, timeoutMs });
+  const sendOnce = (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: 1, timeoutMs, sleep: deps.retrySleep });
+  const send = opts.noRetry ? sendOnce : (url, init) => fetchWithRetry(deps.fetch ?? fetch, url, init, { attempts: RETRY_ATTEMPTS, timeoutMs, sleep: deps.retrySleep });
   try {
     const res = await send(`${deps.baseUrl.replace(/\/$/, "")}${pathSuffix}`, {
       method,
@@ -5106,9 +5093,6 @@ async function upsertProject(slug, patch, deps) {
 async function retireProject(slug, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}`, {}, deps, "DELETE", { noRetry: true });
 }
-async function attestAppGaps(slug, repo, deps) {
-  return postJson(`/projects/${encodeURIComponent(slug)}/attest-app`, { repo }, deps);
-}
 async function setDeployCoords(slug, payload, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/deploy`, payload, deps);
 }
@@ -5118,6 +5102,9 @@ async function recordDocsAudit(verdict, deps) {
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
+async function tenantReconcile(payload, deps) {
+  return postJson("/tenant-reconcile", payload, deps, "POST", { noRetry: true });
+}
 async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
@@ -6202,9 +6189,6 @@ function resolveDeployModel(meta, repo) {
   if (projectType === "cli-tool") return "registry-publish";
   return "tenant-container";
 }
-function projectTypeClearsWebProfile(projectType, deployModel) {
-  return projectType === "content" || projectType === "desktop-app" || projectType === "desktop-game" || projectType === "non-deployable" || projectType === "cli-tool" || deployModel === "content" || deployModel === "none" || deployModel === "registry-publish";
-}
 function inferReleaseTrackFromBranches(hints) {
   if (hints.hasRcBranch) return void 0;
   if (hints.hasDevelopmentBranch && hints.hasMainBranch) return "direct";
@@ -7172,9 +7156,10 @@ async function secretsUse(deps, key, opts) {
         "",
         "Consume it WITHOUT committing it:",
         `  \u2022 Keyless run: \`mmi-cli secrets use ${key}${opts.slug ? ` --slug ${opts.slug}` : ""} -- <command>\` injects it into the command's env (never printed). A granted non-master can USE an org secret this way.`,
-        `  \u2022 Runtime / agents: read it keylessly at runtime via the box's OIDC role. Never bake it into an image or commit it.`,
+        "  \u2022 Runtime: the central deploy injects the declared stage env; broker consumers use the workload's scoped runtime token. Never bake a value into an image or commit it.",
         `  \u2022 CI (GitHub Actions): the workflow assumes its OIDC role and runs \`aws ssm get-parameter --with-decryption --name ${path2}\` \u2014 no GitHub secret.`,
-        tier === "project" ? "  \u2022 One stageless value per repo (/mmi-future/<slug>/<KEY>) \u2014 no dev/rc/main copies. Project-admins self-serve their repo keys." : "  \u2022 Org-infra/cross-slug keys remain master-gated unless granted; project-admins self-serve their own repo keys."
+        "  \u2022 Own project: the stageless canonical and any declared dev/rc/main overrides are project-admin self-service.",
+        "  \u2022 Org-infra/cross-slug keys remain master-gated unless exactly granted."
       ].join("\n")
     );
     return;
@@ -10386,7 +10371,14 @@ var import_node_util6 = require("node:util");
 var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 var EARLY_EXIT_GRACE_MS = 2e3;
-function waitForProcessStability(child2, graceMs = EARLY_EXIT_GRACE_MS) {
+function earlyExitGraceMs() {
+  if (process.env.NODE_ENV === "test") {
+    const testOverride = Number(process.env.MMI_CLI_TEST_EARLY_EXIT_GRACE_MS);
+    if (Number.isFinite(testOverride) && testOverride >= 25) return testOverride;
+  }
+  return EARLY_EXIT_GRACE_MS;
+}
+function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
   return new Promise((resolve5, reject) => {
     let settled = false;
     const finish = (fn) => {
@@ -11504,20 +11496,18 @@ for (const [helpGroup, names] of PRIMARY_GROUPS) {
   for (const name of names) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
 }
 HELP_GROUP_ORDER.set("Operations", HELP_GROUP_ORDER.size);
-HELP_GROUP_ORDER.set("Compatibility", HELP_GROUP_ORDER.size);
-HELP_GROUP_ORDER.set("Delegated", HELP_GROUP_ORDER.size);
 for (const name of OPERATIONAL_TOP_LEVEL) TOP_LEVEL_ORDER.set(name, topLevelPosition++);
-TOP_LEVEL_ORDER.set("lane", topLevelPosition++);
-TOP_LEVEL_ORDER.set("fusion", topLevelPosition++);
 var PATH_OVERRIDES = {
   "board slice-refresh": { category: "internal", discovery: "hidden", help_group: "Operations" },
-  lane: { category: "delegated", discovery: "hidden", help_group: "Delegated", replacement: "jerv-cli lane" },
-  fusion: { category: "delegated", discovery: "hidden", help_group: "Delegated", replacement: "jerv-cli fusion" }
+  "secrets find": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets catalog": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets doctor": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets org-catalog": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets grant": { category: "admin", discovery: "all-only", help_group: "Operations" },
+  "secrets revoke": { category: "admin", discovery: "all-only", help_group: "Operations" }
 };
 var HIDDEN_OPTIONS = {
   "worktree create": ["--base"],
-  "org project doctor": ["--v2"],
-  "org project heal": ["--v2"],
   "org project set": ["--set"]
 };
 function primaryMetadata(name) {
@@ -11535,7 +11525,6 @@ function primaryMetadata(name) {
 function topLevelMetadata(name) {
   const primary = primaryMetadata(name);
   if (primary) return primary;
-  if (name === "lane" || name === "fusion") return PATH_OVERRIDES[name];
   if (!OPERATIONAL_TOP_LEVEL.has(name)) {
     throw new Error(`command taxonomy: unclassified top-level command "${name}"`);
   }
@@ -11605,113 +11594,7 @@ function commandHelpGroupRank(group) {
   return HELP_GROUP_ORDER.get(group) ?? Number.MAX_SAFE_INTEGER;
 }
 function isCanonicalSuggestion(metadata) {
-  return metadata.category !== "internal" && metadata.category !== "delegated" && metadata.category !== "shim" && metadata.category !== "obsolete";
-}
-
-// src/command-shims.ts
-var COMMAND_SHIMS = [
-  { legacy: "project deploy list", canonical: "org project deploy get", category: "shim" },
-  { legacy: "project resolve", canonical: "org project deploy get", category: "obsolete" },
-  { legacy: "tenant readiness", canonical: "runtime tenant status", category: "shim" },
-  { legacy: "secrets edit", canonical: "secrets set", category: "shim" },
-  { legacy: "registry org", canonical: "org config get", category: "shim" },
-  { legacy: "rules gitignore", canonical: "org rules gitignore", category: "shim" },
-  { legacy: "deploy status", canonical: "runtime deploy status", category: "shim" },
-  { legacy: "full-track readiness", canonical: "train readiness", category: "shim" },
-  { legacy: "docs-audit", canonical: "docs audit", category: "shim", subtree: true },
-  { legacy: "plugin-heal", canonical: "plugin heal", category: "shim" },
-  { legacy: "plugin-prune", canonical: "plugin prune", category: "shim" },
-  { legacy: "session-start", canonical: "plugin session-start", category: "shim" },
-  { legacy: "port-range", canonical: "stage port-range", category: "shim" },
-  { legacy: "schedules", canonical: "org schedules", category: "shim" },
-  { legacy: "guard", canonical: "plugin guard", category: "shim" },
-  { legacy: "project", canonical: "org project", category: "shim", subtree: true },
-  { legacy: "oauth", canonical: "org oauth", category: "shim", subtree: true },
-  { legacy: "access", canonical: "org access", category: "shim", subtree: true },
-  { legacy: "tenant", canonical: "runtime tenant", category: "shim", subtree: true },
-  { legacy: "box", canonical: "runtime box", category: "shim", subtree: true },
-  { legacy: "edge", canonical: "runtime edge", category: "shim", subtree: true },
-  { legacy: "gc", canonical: "worktree gc", category: "shim", subtree: true }
-];
-function rewriteLegacyArgv(argv) {
-  const commandArgs = argv.slice(2);
-  for (const shim of COMMAND_SHIMS) {
-    const legacy = shim.legacy.split(" ");
-    if (!legacy.every((token, index) => commandArgs[index] === token)) continue;
-    const canonical = shim.canonical.split(" ");
-    return {
-      argv: [...argv.slice(0, 2), ...canonical, ...commandArgs.slice(legacy.length)],
-      shim,
-      warning: `mmi-cli: \`${shim.legacy}\` moved to \`${shim.canonical}\`; use \`mmi-cli ${shim.canonical}\`.`
-    };
-  }
-  return { argv: [...argv] };
-}
-
-// src/command-consolidation.ts
-var COMMAND_NAMESPACES_CONSOLIDATED = /* @__PURE__ */ Symbol.for("mmi.commandNamespaces.consolidated");
-function child(parent, name) {
-  const found = parent.commands.find((command) => command.name() === name);
-  if (!found) throw new Error(`command consolidation: missing "${parent.name()} ${name}"`);
-  return found;
-}
-function detach(parent, command) {
-  const commands = parent.commands;
-  const index = commands.indexOf(command);
-  if (index < 0) throw new Error(`command consolidation: "${command.name()}" is not a child of "${parent.name()}"`);
-  commands.splice(index, 1);
-  return command;
-}
-function move(parent, destination, name, nextName = name) {
-  const command = detach(parent, child(parent, name));
-  command.name(nextName);
-  destination.addCommand(command);
-  return command;
-}
-function remove(parent, name) {
-  detach(parent, child(parent, name));
-}
-function consolidateCommandNamespaces(program3) {
-  const org = program3.command("org").description("organization projects, access, rules, credentials, and schedules");
-  const runtime = program3.command("runtime").description("tenant, deploy, box, and edge operations");
-  const plugin = program3.command("plugin").description("plugin lifecycle and guard operations");
-  move(program3, org, "project");
-  move(program3, org, "oauth");
-  move(program3, org, "access");
-  move(program3, org, "schedules");
-  const config = org.command("config").description("organization configuration");
-  const registry2 = child(program3, "registry");
-  move(registry2, config, "org", "get");
-  remove(program3, "registry");
-  const orgRules = org.command("rules").description("organization-managed repository rules");
-  const rules2 = child(program3, "rules");
-  move(rules2, orgRules, "gitignore");
-  remove(program3, "rules");
-  move(program3, runtime, "tenant");
-  const runtimeDeploy = runtime.command("deploy").description("runtime deployment status");
-  const deploy = child(program3, "deploy");
-  move(deploy, runtimeDeploy, "status");
-  remove(program3, "deploy");
-  move(program3, runtime, "box");
-  move(program3, runtime, "edge");
-  move(program3, plugin, "guard");
-  move(program3, plugin, "plugin-heal", "heal");
-  move(program3, plugin, "plugin-prune", "prune");
-  move(program3, plugin, "session-start");
-  const docs2 = child(program3, "docs");
-  move(program3, docs2, "docs-audit", "audit");
-  const train = child(program3, "train");
-  const fullTrack2 = child(program3, "full-track");
-  move(fullTrack2, train, "readiness");
-  remove(program3, "full-track");
-  const worktree2 = child(program3, "worktree");
-  move(program3, worktree2, "gc");
-  const stage = child(program3, "stage");
-  move(program3, stage, "port-range");
-  program3[COMMAND_NAMESPACES_CONSOLIDATED] = true;
-}
-function hasConsolidatedCommandNamespaces(program3) {
-  return program3[COMMAND_NAMESPACES_CONSOLIDATED] === true;
+  return metadata.category !== "internal";
 }
 
 // src/command-manifest.ts
@@ -11780,63 +11663,6 @@ function buildCommand(cmd, path2) {
   if (commonMistakes) out.common_mistakes = commonMistakes;
   return out;
 }
-function findTreeCommand(root, path2) {
-  if (root.path === path2) return root;
-  for (const child2 of root.subcommands) {
-    const found = findTreeCommand(child2, path2);
-    if (found) return found;
-  }
-  return void 0;
-}
-function virtualCopy(source, path2, shim) {
-  return {
-    ...source,
-    name: path2.split(" ").at(-1),
-    path: path2,
-    category: shim.category,
-    discovery: "all-only",
-    help_group: "Compatibility",
-    replacement: source.path,
-    subcommands: shim.subtree ? source.subcommands.map((child2) => virtualCopy(child2, `${path2} ${child2.name}`, shim)) : []
-  };
-}
-function virtualParent(path2, shim) {
-  return {
-    name: path2.split(" ").at(-1),
-    path: path2,
-    description: `compatibility namespace; use mmi-cli ${shim.canonical}`,
-    arguments: [],
-    options: [],
-    subcommands: [],
-    category: "shim",
-    discovery: "all-only",
-    help_group: "Compatibility",
-    replacement: shim.canonical
-  };
-}
-function insertVirtualShim(root, shim) {
-  const canonical = findTreeCommand(root, shim.canonical);
-  if (!canonical) throw new Error(`command manifest: shim target missing "${shim.canonical}"`);
-  const parts = shim.legacy.split(" ");
-  let parent = root;
-  for (let index = 0; index < parts.length - 1; index += 1) {
-    const path2 = parts.slice(0, index + 1).join(" ");
-    let next = parent.subcommands.find((command) => command.name === parts[index]);
-    if (!next) {
-      next = virtualParent(path2, shim);
-      parent.subcommands.push(next);
-    }
-    parent = next;
-  }
-  const copy = virtualCopy(canonical, shim.legacy, shim);
-  const existingIndex = parent.subcommands.findIndex((command) => command.name === copy.name);
-  if (existingIndex >= 0) parent.subcommands[existingIndex] = copy;
-  else parent.subcommands.push(copy);
-}
-function addVirtualShims(root) {
-  for (const shim of COMMAND_SHIMS.filter((entry) => entry.subtree)) insertVirtualShim(root, shim);
-  for (const shim of COMMAND_SHIMS.filter((entry) => !entry.subtree)) insertVirtualShim(root, shim);
-}
 function primaryCopy(node, root = false) {
   if (!root && node.discovery !== "primary") return void 0;
   const subcommands = node.subcommands.map((child2) => primaryCopy(child2)).filter((child2) => Boolean(child2));
@@ -11856,7 +11682,6 @@ function collectLeaves(node, acc) {
 }
 function buildCommandManifest(program3) {
   const tree = buildCommand(program3, "");
-  if (hasConsolidatedCommandNamespaces(program3)) addVirtualShims(tree);
   const index = [];
   collectLeaves(tree, index);
   const primaryTree = primaryCopy(tree, true);
@@ -11913,10 +11738,71 @@ function formatManifestHuman(manifest, options = {}) {
     }
     render(command, 1);
   }
-  lines.push("", options.all ? "Use `mmi-cli explain <group|command>` for a focused map." : "Use `mmi-cli explain <group|command>` for detail or `mmi-cli commands --all` for operations and compatibility.");
+  lines.push("", options.all ? "Use `mmi-cli explain <group|command>` for a focused map." : "Use `mmi-cli explain <group|command>` for detail or `mmi-cli commands --all` for operational depth.");
   return lines.join("\n");
 }
 
+// src/command-consolidation.ts
+function child(parent, name) {
+  const found = parent.commands.find((command) => command.name() === name);
+  if (!found) throw new Error(`command consolidation: missing "${parent.name()} ${name}"`);
+  return found;
+}
+function detach(parent, command) {
+  const commands = parent.commands;
+  const index = commands.indexOf(command);
+  if (index < 0) throw new Error(`command consolidation: "${command.name()}" is not a child of "${parent.name()}"`);
+  commands.splice(index, 1);
+  return command;
+}
+function move(parent, destination, name, nextName = name) {
+  const command = detach(parent, child(parent, name));
+  command.name(nextName);
+  destination.addCommand(command);
+  return command;
+}
+function remove(parent, name) {
+  detach(parent, child(parent, name));
+}
+function consolidateCommandNamespaces(program3) {
+  const org = program3.command("org").description("organization projects, access, rules, credentials, and schedules");
+  const runtime = program3.command("runtime").description("tenant, deploy, box, and edge operations");
+  const plugin = program3.command("plugin").description("plugin lifecycle and guard operations");
+  move(program3, org, "project");
+  move(program3, org, "oauth");
+  move(program3, org, "access");
+  move(program3, org, "schedules");
+  const config = org.command("config").description("organization configuration");
+  const registry2 = child(program3, "registry");
+  move(registry2, config, "org", "get");
+  remove(program3, "registry");
+  const orgRules = org.command("rules").description("organization-managed repository rules");
+  const rules2 = child(program3, "rules");
+  move(rules2, orgRules, "gitignore");
+  remove(program3, "rules");
+  move(program3, runtime, "tenant");
+  const runtimeDeploy = runtime.command("deploy").description("runtime deployment status");
+  const deploy = child(program3, "deploy");
+  move(deploy, runtimeDeploy, "status");
+  remove(program3, "deploy");
+  move(program3, runtime, "box");
+  move(program3, runtime, "edge");
+  move(program3, plugin, "guard");
+  move(program3, plugin, "plugin-heal", "heal");
+  move(program3, plugin, "plugin-prune", "prune");
+  move(program3, plugin, "session-start");
+  const docs2 = child(program3, "docs");
+  move(program3, docs2, "docs-audit", "audit");
+  const train = child(program3, "train");
+  const fullTrack2 = child(program3, "full-track");
+  move(fullTrack2, train, "readiness");
+  remove(program3, "full-track");
+  const worktree2 = child(program3, "worktree");
+  move(program3, worktree2, "gc");
+  const stage = child(program3, "stage");
+  move(program3, stage, "port-range");
+}
+
 // src/version-lag.ts
 var VERSION_LABEL = "installed plugin/adapter cache freshness";
 var VERSION_FIX = "update the MMI plugin via /plugin; standalone npm CLI: npm install -g @mutmutco/cli@latest";
@@ -12449,6 +12335,14 @@ function parseVerifySecrets(stdout) {
   }
   return out;
 }
+function parseVerifyBroker(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    const match = /^(\S+):\s*(reachable|missing|denied|error)\b/.exec(line.trim());
+    if (match) out.push({ key: match[1], status: match[2] });
+  }
+  return out;
+}
 
 // src/train-apply.ts
 function resolveDeployModel2(meta, repo) {
@@ -12732,7 +12626,7 @@ function classifyProjectGetFailure(text) {
 }
 async function loadProjectMeta(deps, ctx) {
   try {
-    const out = await deps.runSelf(["project", "get", ctx.repo]);
+    const out = await deps.runSelf(["org", "project", "get", ctx.repo]);
     const parsed = JSON.parse(out);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { status: "read-error", error: "invalid registry META JSON" };
@@ -12851,6 +12745,9 @@ function correlatePublishRun(deps, since, titleIncludes) {
 function correlateControlRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
 }
+function correlateReconcileRun(deps, since, titleIncludes) {
+  return correlateRun(deps, { workflow: "tenant-reconcile.yml", since, mode: "dispatch", titleIncludes });
+}
 async function correlateWorkflowRun(deps, args) {
   return correlateRun(deps, { ...args, mode: "workflow" });
 }
@@ -13906,8 +13803,36 @@ async function runTenantRedeploy(deps, options) {
   const d = await dispatchDeploy(deps, ctx, stage, ref, deployModel, watch);
   return { ...ctx, command: "tenant-redeploy", stage, ref, deployModel, dispatch: d.note, runId: d.runId, runUrl: d.runUrl, workflowRuns: d.workflowRuns, deployStatus: d.deployStatus };
 }
+async function runTenantReconcile(deps, options) {
+  const parts = options.repo.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) throw new Error(`repo must be owner/name, got ${options.repo}`);
+  if (!["dev", "rc", "main"].includes(options.stage)) throw new Error(`stage must be dev, rc, or main, got ${options.stage}`);
+  if (!deps.dispatchTenantReconcile) throw new Error("tenant reconcile dispatch is unavailable");
+  const stage = options.stage;
+  const base = { command: "tenant-reconcile", repo: options.repo, stage };
+  const since = (deps.now ?? Date.now)();
+  const dispatched = await deps.dispatchTenantReconcile({ repo: options.repo, stage });
+  if (!dispatched.ok) {
+    return {
+      ...base,
+      dispatched: false,
+      conclusion: "failure",
+      note: `tenant reconcile rejected: ${dispatched.error ?? "request rejected by the Hub"}`
+    };
+  }
+  const slug = parts[1].toLowerCase();
+  const run = await correlateReconcileRun(deps, since, [slug, stage]);
+  const conclusion = options.watch ?? true ? await watchTenantRun(deps, run.runId) : "pending";
+  return {
+    ...base,
+    dispatched: true,
+    ...run,
+    conclusion,
+    note: conclusion === "success" ? "tenant-reconcile run succeeded" : conclusion === "failure" ? "tenant-reconcile run failed \u2014 inspect the run before redeploying" : "tenant-reconcile dispatched but not confirmed \u2014 do not redeploy until the run succeeds"
+  };
+}
 function tenantControlWatches(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets";
+  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker";
 }
 async function runTenantControl(deps, options) {
   const { repo, stage, action } = options;
@@ -13931,13 +13856,16 @@ async function runTenantControl(deps, options) {
   if (action === "retire") {
     result.category = conclusion === "success" ? "retired" : conclusion === "failure" ? "control-run-failed" : "wait-timeout";
   }
-  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets")) {
+  if (watch && runId != null && conclusion === "success" && (action === "status" || action === "verify-secrets" || action === "verify-broker")) {
     const output = extractControlOutputFromLog(await fetchControlRunLog(deps, runId));
     if (action === "status") {
       result.serviceState = parseStatusSnippet(output).serviceState;
-    } else {
+    } else if (action === "verify-secrets") {
       result.secrets = parseVerifySecrets(output);
       result.secretsRaw = output;
+    } else {
+      result.broker = parseVerifyBroker(output);
+      result.brokerRaw = output;
     }
   }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
@@ -13987,6 +13915,26 @@ function renderVerifySecrets(body) {
   return { lines, failure: null };
 }
 
+// src/tenant-verify-broker.ts
+function renderVerifyBroker(input) {
+  if (input.broker.length === 0) {
+    const raw = input.raw?.trim();
+    if (raw?.startsWith("no broker-readable runtime secrets declared")) return { lines: [raw], failure: null };
+    return {
+      lines: raw ? raw.split("\n") : ["verify-broker: no per-key verdicts returned"],
+      failure: "verify-broker returned no per-key verdicts, so broker access was not verified"
+    };
+  }
+  const lines = input.broker.map((item) => `${item.key}: ${item.status}`);
+  const reachable = input.broker.filter((item) => item.status === "reachable").length;
+  const bad = input.broker.length - reachable;
+  lines.push(`verify-broker: ${reachable} reachable, ${bad} failed`);
+  return {
+    lines,
+    failure: bad > 0 ? `${bad} of ${input.broker.length} broker read(s) failed; redeploy refreshes an expired runtime token` : null
+  };
+}
+
 // src/hotfix-coverage.ts
 var import_node_child_process8 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
@@ -15009,14 +14957,10 @@ function loadAccessTargets(projectsJson) {
   const seen = /* @__PURE__ */ new Set();
   const targets = [];
   for (const project2 of projects) {
-    const embeddedContent = new Set(
-      (project2.fanoutTargets ?? []).filter((r) => r.class === "content" && r.repo).map((r) => r.repo.toLowerCase())
-    );
     for (const repo of project2.repos ?? []) {
       if (seen.has(repo)) continue;
       seen.add(repo);
-      const repoName = repo.split("/").pop()?.toLowerCase() ?? repo.toLowerCase();
-      const cls = project2.class === "content" || project2.deployModel === "content" || embeddedContent.has(repo.toLowerCase()) || embeddedContent.has(repoName) ? "content" : "deployable";
+      const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
       const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
       targets.push({ repo, class: cls, releaseTrack });
     }
@@ -15096,9 +15040,13 @@ function renderAccessReport(report) {
 var import_node_fs16 = require("node:fs");
 var import_node_path14 = require("node:path");
 var DOCS_INDEX_PATH = "docs/index.md";
+function isRoutableDocsPath(relPath) {
+  const normalized = relPath.replace(/\\/g, "/");
+  return normalized !== "index.md" && normalized.split("/")[0]?.toLowerCase() !== "archive";
+}
 var GENERATED_HEADER = "<!-- Generated by `mmi-cli docs index --write`. Do not edit by hand. -->";
-function escapeCell(text) {
-  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+function plainInline(text) {
+  return text.replace(/\r?\n/g, " ").replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/`/g, "").replace(/\*+/g, "").replace(/~~/g, "").replace(/__([^_]+)__/g, "$1").replace(/(^|[\s(])_([^_]+)_($|[\s).,!?:;])/g, "$1$2$3").replace(/^>\s*/, "").replace(/\\([\\`*_\[\]{}()#+.!|>-])/g, "$1").replace(/\s+/g, " ").trim();
 }
 function extractDocMeta(relPath, raw) {
   const lines = raw.split(/\r?\n/);
@@ -15126,7 +15074,7 @@ function extractDocMeta(relPath, raw) {
       break;
     }
     if (trimmed.startsWith("#")) continue;
-    scope = escapeCell(trimmed);
+    scope = plainInline(trimmed);
     break;
   }
   if (!title) {
@@ -15138,16 +15086,16 @@ function extractDocMeta(relPath, raw) {
 function renderDocsIndex(entries) {
   const lines = [
     GENERATED_HEADER,
+    "",
     "# Documentation index",
     "",
     "Generated from the `docs/` tree by `mmi-cli docs index --write`. `--check` fails on drift, so this index",
     "can never diverge from the records it lists.",
-    "",
-    "| Document | Scope |",
-    "| --- | --- |"
+    ""
   ];
   for (const entry of entries) {
-    lines.push(`| [${escapeCell(entry.title)}](${entry.path}) | ${entry.scope} |`);
+    const link = `[${plainInline(entry.title)}](${entry.path})`;
+    lines.push(entry.scope ? `- ${link} \u2014 ${plainInline(entry.scope)}` : `- ${link}`);
   }
   return lines.join("\n") + "\n";
 }
@@ -15183,7 +15131,7 @@ function createDocsIndexDeps(repoRoot2) {
   const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
   const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
-    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter((p) => p !== "index.md").sort() : [],
+    listDocs: () => (0, import_node_fs16.existsSync)(docsDir) ? walkMarkdown(docsDir).filter(isRoutableDocsPath).sort() : [],
     readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
     readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
     writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
@@ -15290,427 +15238,6 @@ function docsAuditStatus(fetch2, opts) {
   return { ok: true, state: "clean", line: `docs audit: ${opts.repo} ${verdict.outcome} (${verdict.date}, ${verdict.checkerVendor})` };
 }
 
-// src/project-readiness.ts
-function stagesForTrack(meta) {
-  return branchesForTrack(resolveReleaseTrack(meta)).map((b) => b === "development" ? "dev" : b);
-}
-function stageInTrack(meta, stage) {
-  return stagesForTrack(meta).includes(stage);
-}
-function dnsErrorToResolution(code) {
-  return code === "ENOTFOUND" || code === "EAI_NONAME" ? false : void 0;
-}
-var STAGES = ["dev", "rc", "main"];
-var DEFAULT_RUNTIME_SECRET_NAMES2 = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
-function boardRegistryGaps(meta) {
-  if (!meta?.projectId) return [];
-  if (meta.projectNumber != null) return [];
-  return ["projectNumber"];
-}
-function previewRegistryMetaMerge(existing, patch) {
-  const out = { ...existing ?? {} };
-  for (const [key, value] of Object.entries(patch)) {
-    if (value === null) delete out[key];
-    else out[key] = value;
-  }
-  return out;
-}
-function boardLinkWriteError(patch, existing) {
-  const patchHasProjectId = typeof patch.projectId === "string" && patch.projectId.length > 0;
-  const patchHasProjectNumber = typeof patch.projectNumber === "number" && Number.isFinite(patch.projectNumber);
-  if (patchHasProjectId && !patchHasProjectNumber && existing?.projectNumber == null) {
-    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
-  }
-  if (patch.projectNumber === null && boardRegistryGaps(previewRegistryMetaMerge(existing, patch)).length) {
-    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
-  }
-  return null;
-}
-function boardRegistryGapMessage(repo) {
-  return `Board META incomplete for ${repo}: registry has projectId but no projectNumber \u2014 board claim and auto-add will fail until projectNumber is backfilled (re-run \`node infra/migrate/seed-registry.mjs\` or \`mmi-cli bootstrap apply --execute\` with board vars)`;
-}
-var slugOfRepo = slugOf;
-function repoFrom(repoOrSlug, slug) {
-  return repoOrSlug.includes("/") ? repoOrSlug : `mutmutco/${slug}`;
-}
-function defaultSubdomain(slug) {
-  return slug.replace(/^[a-z]+-/, "");
-}
-function projectRequiresGoogleOAuth(meta, model) {
-  if (!meta || model === "content" || model === "none" || meta.deployModel === "content" || meta.deployModel === "none" || meta.class === "content") return false;
-  const projectType = resolveProjectType(meta, meta.repos?.[0] ?? "");
-  if (projectType !== "web-app") return false;
-  return Boolean(meta.oauth && typeof meta.oauth === "object");
-}
-function declaresNoPublicEdge(meta) {
-  const ed = meta?.edgeDomains;
-  return Boolean(ed && typeof ed === "object" && !Array.isArray(ed) && Object.keys(ed).length === 0);
-}
-function declaresWorker(meta) {
-  return meta?.projectType === "worker";
-}
-function isCentralContainerModel(model) {
-  return model === "tenant-container" || model === "solo-container";
-}
-function isNoEdgeTenantWorker(meta, model) {
-  return isCentralContainerModel(model) && (declaresNoPublicEdge(meta) || declaresWorker(meta));
-}
-function projectRequiresDeployCoords(model, stage, meta) {
-  if (!isCentralContainerModel(model)) return false;
-  if (stage && isNoEdgeTenantWorker(meta, model)) return stage === "main";
-  return true;
-}
-function projectRequiresDeployState(model, stage) {
-  return model === "hub-serverless" && stage !== "dev";
-}
-function stageRequiredSecrets(stage, meta) {
-  const contract = meta.requiredRuntimeSecrets;
-  const extra = !Array.isArray(contract) && Array.isArray(contract?.[stage]) ? contract[stage] ?? [] : [];
-  const model = resolveDeployModel(meta, meta.repos?.[0] ?? "");
-  if (isNoEdgeTenantWorker(meta, model) && stage !== "main") return [];
-  const defaults = projectRequiresGoogleOAuth(meta, model) ? DEFAULT_RUNTIME_SECRET_NAMES2 : [];
-  return [.../* @__PURE__ */ new Set([...defaults, ...extra])];
-}
-function stageKey2(stage, key) {
-  return key.includes("/") ? key : `${stage}/${key}`;
-}
-function materializedRuntimeSecretName(entry) {
-  return entry.includes(":") ? entry.split(":").pop() : entry;
-}
-function runtimeSecretStreamGap(stage, meta, presentSecrets) {
-  const streamed = new Set(
-    (contractByStage(meta.requiredRuntimeSecrets)[stage] ?? []).map(materializedRuntimeSecretName)
-  );
-  const seen = /* @__PURE__ */ new Set();
-  const gap = [];
-  for (const name of stageRequiredSecrets(stage, meta).map(materializedRuntimeSecretName)) {
-    if (seen.has(name)) continue;
-    seen.add(name);
-    if (!streamed.has(name) && (presentSecrets.has(stageKey2(stage, name)) || presentSecrets.has(name))) gap.push(name);
-  }
-  return gap;
-}
-function hasRuntimeSecretContract(contract) {
-  if (!contract || typeof contract !== "object" || Array.isArray(contract)) return false;
-  return ["dev", "rc", "main"].some((stage) => Array.isArray(contract[stage]));
-}
-function appAttestationOf(meta) {
-  const a = meta?.appAttested;
-  if (!a || typeof a !== "object" || Array.isArray(a)) return null;
-  const { at, by } = a;
-  return typeof at === "string" && at.length > 0 && typeof by === "string" && by.length > 0 ? { at, by } : null;
-}
-function attestedLine(att) {
-  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli org project attest\` after app-owned structural changes.`;
-}
-var CONTRACT_UNDECLARED_LINE = "No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).";
-function appGapsFor(meta, model, slug, projectType, mainDeployFact) {
-  const attested = appAttestationOf(meta);
-  const isTenantWeb = !(projectType === "content" || model === "content") && projectType !== "desktop-app" && projectType !== "desktop-game" && projectType !== "cli-tool" && !(projectType === "non-deployable" || model === "none") && model !== "hub-serverless" && model !== "serverless" && model !== "registry-publish";
-  const contractUndeclared = isTenantWeb && Boolean(meta) && !hasRuntimeSecretContract(meta?.requiredRuntimeSecrets);
-  if (attested) return contractUndeclared ? [attestedLine(attested), CONTRACT_UNDECLARED_LINE] : [attestedLine(attested)];
-  if (projectType === "content" || model === "content") return ["Content repo: keep app-owned work to docs/content changes; release train does not apply."];
-  if (projectType === "desktop-app") {
-    return [
-      "Desktop app: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default; keep app-owned installer/packaging outside the tenant train.",
-      "Keep README.md and architecture.md explicit about the per-OS build and distribution path (installer, and any registry publish alongside it) so readiness does not guess web infra."
-    ];
-  }
-  if (projectType === "desktop-game") {
-    return [
-      "Desktop game: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default; keep app-owned release packaging outside the tenant train.",
-      "Keep README.md and architecture.md explicit about the game build/release path so readiness does not guess web infra."
-    ];
-  }
-  if (projectType === "non-deployable" || model === "none") {
-    return [
-      "Non-deployable repo: no Hub deploy coords, Google OAuth, DWD, or runtime tenant control by default.",
-      "Keep README.md and architecture.md explicit about the repo purpose and any project-admin workflow it still needs."
-    ];
-  }
-  if (model === "hub-serverless") {
-    return [
-      "Hub serverless deploy stays on the Hub-owned workflows; deploy.yml stamps per-stage deploy state onto state-only DEPLOY# rows (no tenant coords).",
-      "Make runtime config fail clearly for missing required env in prod/rc instead of relying on hidden defaults."
-    ];
-  }
-  if (model === "serverless") {
-    return [
-      "Serverless deploys use the central serverless path; do not add tenant compose or box plumbing.",
-      "Make runtime config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
-      "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
-    ];
-  }
-  if (projectType === "cli-tool" || model === "registry-publish") {
-    return [
-      "Distributable CLI/plugin: ship a publishable package.json (name, version, bin/exports) \u2014 release publishes to npm (plugin-marketplace publish is future work when a plugin tenant lands), not a box deploy; no Hub deploy coords, edge, or OAuth.",
-      "Keep the published version in lockstep with the release tag; make the publish idempotent (skip when the version is already on the registry).",
-      "Keep app-owned README.md and architecture.md aligned with the registry-publish release path."
-    ];
-  }
-  const gaps = [
-    'Ensure the compose is fileless (#2662) \u2014 drop env_file: and mark each runtime-secret service with the mmi.runtime-env: "true" label; the box injects coords + declared runtime secrets into the container process env at deploy (no .env on disk); the app reads plain environment variables and never self-loads SSM.',
-    "Make app config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
-    "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
-  ];
-  if (isNoEdgeTenantWorker(meta, model)) {
-    gaps.unshift("No public edge (worker/outbound-only tenant \u2014 `projectType: worker` or `edgeDomains: {}`): skip Cloudflare edge auto-heal, OAuth defaults, and dev/rc remote deploy coords unless META explicitly adds them.");
-  }
-  if (contractUndeclared) {
-    gaps.unshift(CONTRACT_UNDECLARED_LINE);
-  }
-  if (slug === "mmi-katip") {
-    gaps.push("Katip-specific app plan: declare Google Workspace service-account requirements, use the service account numeric OAuth2 client ID for DWD, remove prod-hidden impersonation defaults, and make non-critical Google Workspace failures degrade instead of crash-looping.");
-  }
-  if (model === "solo-container" || model === "tenant-container") {
-    if (typeof mainDeployFact?.port === "number") {
-      gaps.push(`Seed DEPLOY#main healthUrl to http://127.0.0.1:${mainDeployFact.port}/health during bootstrap (tenant reconcile/control health gate \u2014 #1202; port read from DEPLOY#main).`);
-    } else if (!appAttestationOf(meta)) {
-      gaps.push("Seed DEPLOY#main healthUrl from the DEPLOY#main edgeVhost.port during bootstrap (tenant reconcile/control health gate \u2014 #1202); doctor has no committed DEPLOY port to cite yet.");
-    }
-  }
-  if (!meta) gaps.unshift("No app-owned repo changes can be planned precisely until Hub registry META exists.");
-  return gaps;
-}
-function edgeDomainsByStage(meta) {
-  const ed = meta?.edgeDomains;
-  if (!ed || typeof ed !== "object" || Array.isArray(ed)) return {};
-  const out = {};
-  for (const stage of STAGES) {
-    const v = ed[stage];
-    if (typeof v === "string" && v.trim()) out[stage] = v.trim();
-  }
-  return out;
-}
-async function probeEdgeDomains(meta, resolveDns) {
-  const byStage = edgeDomainsByStage(meta);
-  const results = await Promise.all(
-    Object.entries(byStage).map(async ([stage, host]) => {
-      let resolved;
-      try {
-        resolved = await resolveDns(host);
-      } catch {
-        resolved = void 0;
-      }
-      return resolved === false ? { stage, host } : void 0;
-    })
-  );
-  return results.filter((r) => r !== void 0);
-}
-function contractByStage(contract) {
-  return contract && !Array.isArray(contract) ? contract : {};
-}
-function ensureStageNames(names, required) {
-  return [.../* @__PURE__ */ new Set([...names ?? [], ...required])];
-}
-function sameNames(a, b) {
-  const left = new Set(a ?? []);
-  const right = new Set(b ?? []);
-  if (left.size !== right.size) return false;
-  return [...left].every((name) => right.has(name));
-}
-function sameStageContract(a, b) {
-  return STAGES.every((stage) => sameNames(a[stage], b[stage]));
-}
-function buildV2HealPatch(repoOrSlug, meta, mainDeployFact) {
-  const slug = slugOfRepo(repoOrSlug);
-  const repo = repoFrom(repoOrSlug, slug);
-  const sub = defaultSubdomain(slug);
-  const patch = {};
-  const confidentType = resolveProjectTypeConfident(meta, repo);
-  const projectType = confidentType ?? resolveProjectType(meta, repo);
-  const model = resolveDeployModel(meta, repo);
-  if (confidentType && !meta?.class) patch.class = confidentType === "content" ? "content" : "deployable";
-  if (confidentType) {
-    if (!meta?.projectType) patch.projectType = confidentType;
-    if (!meta?.deployModel) patch.deployModel = model;
-  }
-  if (!meta?.vaultPath) patch.vaultPath = `/mmi-future/${slug}`;
-  if (confidentType && !meta?.edgeDomains && model === "tenant-container" && projectType !== "worker") {
-    patch.edgeDomains = {
-      dev: `dev.${sub}.mutatismutandis.co`,
-      rc: `rc.${sub}.mutatismutandis.co`,
-      main: `${sub}.mutatismutandis.co`
-    };
-  }
-  if (meta && projectTypeClearsWebProfile(projectType, model)) {
-    if (meta.oauth !== void 0) patch.oauth = null;
-    if (meta.edgeDomains !== void 0) patch.edgeDomains = null;
-  }
-  if (slug === "mmi-katip") {
-    const required = ["GOOGLE_IMPERSONATE_USER", "GOOGLE_ADMIN_USER"];
-    const current = contractByStage(meta?.requiredRuntimeSecrets);
-    const next = {
-      dev: ensureStageNames(current.dev, required),
-      rc: ensureStageNames(current.rc, required),
-      main: ensureStageNames(current.main, required)
-    };
-    if (!sameStageContract(current, next)) {
-      patch.requiredRuntimeSecrets = next;
-    }
-  }
-  const appOwnedGaps = confidentType ? appGapsFor(meta, model, slug, confidentType, mainDeployFact) : [`Project type is unset and not derivable \u2014 classify with \`mmi-cli org project set ${repo} --project-type <web-app|hub-service|content|desktop-app|desktop-game|non-deployable|cli-tool|worker> --deploy-model <tenant-container|solo-container|hub-serverless|serverless|registry-publish|content|none>\` before heal completes the v2 fields (prevents defaulting a non-web repo to tenant-container).`];
-  if (boardRegistryGaps(meta).length) appOwnedGaps.unshift(boardRegistryGapMessage(repo));
-  return { slug, patch, appOwnedGaps };
-}
-async function runV2Heal(repoOrSlug, opts, deps) {
-  const slug = slugOfRepo(repoOrSlug);
-  const read = await deps.fetchProject(slug);
-  if (!read.ok) {
-    return { status: "aborted", slug, error: `registry read failed for ${slug} (${read.error}) \u2014 aborting; a failed read must not be treated as a missing project` };
-  }
-  const plan = buildV2HealPatch(repoOrSlug, read.project);
-  if (!opts.apply) return { status: "planned", slug, patch: plan.patch, appOwnedGaps: plan.appOwnedGaps };
-  if (!Object.keys(plan.patch).length) return { status: "noop", slug, appOwnedGaps: plan.appOwnedGaps };
-  const write = await deps.upsertProject(slug, plan.patch);
-  if (!write.ok) return { status: "write-failed", slug, write };
-  return { status: "applied", slug, applied: Object.keys(plan.patch), appOwnedGaps: plan.appOwnedGaps, result: write.body };
-}
-async function buildV2Doctor(repoOrSlug, deps) {
-  const slug = slugOfRepo(repoOrSlug);
-  const repo = repoFrom(repoOrSlug, slug);
-  const read = await deps.getProject(slug);
-  if (!read.ok) {
-    const degradedSecrets = {
-      dev: { required: [], present: [], missing: [] },
-      rc: { required: [], present: [], missing: [] },
-      main: { required: [], present: [], missing: [] }
-    };
-    const degradedStage = {
-      dev: { ok: false, required: false },
-      rc: { ok: false, required: false },
-      main: { ok: false, required: false }
-    };
-    return {
-      ok: false,
-      repo,
-      slug,
-      registryError: read.error,
-      hubOwned: { meta: { ok: false, missing: [] }, deployCoords: degradedStage, deployState: degradedStage, secrets: degradedSecrets },
-      autoHealAvailable: [],
-      appOwnedGaps: [`Hub registry read failed (${read.error}) \u2014 diagnosis degraded; nothing is known about META, coords, or gaps. Likely transient (cold start, network, or auth blip): retry \`mmi-cli org project doctor\` shortly.`]
-    };
-  }
-  const meta = read.project;
-  const projectType = resolveProjectType(meta, repo);
-  const model = resolveDeployModel(meta, repo);
-  const mainDeployFact = meta && deps.getDeployFact ? await deps.getDeployFact(slug, "main") : null;
-  const autoHeal = buildV2HealPatch(repo, meta, mainDeployFact);
-  if (!meta) {
-    const emptySecrets = {
-      dev: { required: [], present: [], missing: [] },
-      rc: { required: [], present: [], missing: [] },
-      main: { required: [], present: [], missing: [] }
-    };
-    const emptyCoords = {
-      dev: { ok: false, required: true },
-      rc: { ok: false, required: true },
-      main: { ok: false, required: true }
-    };
-    const emptyState = Object.fromEntries(STAGES.map((stage) => {
-      const required = projectRequiresDeployState(model, stage);
-      return [stage, { required, ok: !required }];
-    }));
-    return {
-      ok: false,
-      repo,
-      slug,
-      hubOwned: { meta: { ok: false, missing: [`PROJECT#${slug}/META`] }, deployCoords: emptyCoords, deployState: emptyState, secrets: emptySecrets },
-      autoHealAvailable: Object.keys(autoHeal.patch),
-      appOwnedGaps: autoHeal.appOwnedGaps
-    };
-  }
-  let presentSecrets = /* @__PURE__ */ new Set();
-  let secretsError;
-  try {
-    presentSecrets = new Set(await deps.listSecrets(repo));
-  } catch (e) {
-    secretsError = e?.message || "secrets list failed";
-  }
-  const deployCoords = Object.fromEntries(await Promise.all(STAGES.map(async (stage) => {
-    const required = stageInTrack(meta, stage) && projectRequiresDeployCoords(model, stage, meta);
-    return [stage, { required, ok: required ? await deps.hasDeployCoords(slug, stage) : true }];
-  })));
-  const deployState = Object.fromEntries(await Promise.all(STAGES.map(async (stage) => {
-    const required = stageInTrack(meta, stage) && projectRequiresDeployState(model, stage);
-    return [stage, { required, ok: required ? await deps.hasDeployState(slug, stage) : true }];
-  })));
-  const secrets = Object.fromEntries(STAGES.map((stage) => {
-    const names = stageInTrack(meta, stage) ? stageRequiredSecrets(stage, meta) : [];
-    const satisfied = (key) => presentSecrets.has(stageKey2(stage, key)) || !key.includes("/") && presentSecrets.has(key);
-    const required = names.map((key) => stageKey2(stage, key));
-    const present = names.filter(satisfied).map((key) => stageKey2(stage, key));
-    const missing = names.filter((key) => !satisfied(key)).map((key) => stageKey2(stage, key));
-    return [stage, { required, present, missing }];
-  }));
-  const runtimeSecretStreamWarnings = Object.fromEntries(STAGES.map((stage) => [
-    stage,
-    stageInTrack(meta, stage) ? runtimeSecretStreamGap(stage, meta, presentSecrets) : []
-  ]));
-  const runtimeSecretStreamWarningRows = STAGES.map((stage) => ({ stage, names: runtimeSecretStreamWarnings[stage] })).filter((row) => row.names.length > 0);
-  const metaMissing = ["class", "projectType", "deployModel", "vaultPath"].filter((key) => meta[key] === void 0).concat(boardRegistryGaps(meta));
-  const ok = !secretsError && metaMissing.length === 0 && Object.values(deployCoords).every((v) => v.ok) && Object.values(secrets).every((v) => v.missing.length === 0);
-  const edgeDomainWarnings = deps.resolveDns ? await probeEdgeDomains(meta, deps.resolveDns) : [];
-  return {
-    ok,
-    repo,
-    slug,
-    class: meta.class,
-    projectType,
-    deployModel: model,
-    hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets },
-    secretsError,
-    autoHealAvailable: Object.keys(autoHeal.patch),
-    appOwnedGaps: autoHeal.appOwnedGaps,
-    ...edgeDomainWarnings.length ? { edgeDomainWarnings } : {},
-    ...runtimeSecretStreamWarningRows.length ? { runtimeSecretStreamWarnings: runtimeSecretStreamWarningRows } : {},
-    appAttested: appAttestationOf(meta) ?? void 0
-  };
-}
-function renderReadinessIssueBody(existingBody, report, opts = {}) {
-  const start = "<!-- mmi-v2-readiness:start -->";
-  const end = "<!-- mmi-v2-readiness:end -->";
-  const stageLines = STAGES.map((stage) => {
-    const coordState = report.hubOwned.deployCoords[stage];
-    const coords = !coordState.required ? "coords n/a" : coordState.ok ? "coords ok" : "coords missing/unverified";
-    const state = report.hubOwned.deployState[stage];
-    const statePart = !state.required ? [] : [state.ok ? "deploy state stamped" : "deploy state not stamped"];
-    const missing = report.hubOwned.secrets[stage].missing;
-    return `- ${stage}: ${[coords, ...statePart].join("; ")}; ${missing.length ? `missing ${missing.join(", ")}` : "required secret names present"}`;
-  });
-  const section = [
-    start,
-    "## Hub v2 readiness",
-    "",
-    `Repo: ${report.repo}`,
-    `Project type: ${report.projectType ?? "(unresolved)"}`,
-    `Deploy model: ${report.deployModel ?? "(unresolved)"}`,
-    `Overall: ${report.ok ? "ready" : "not ready"}`,
-    "",
-    "### Hub-owned diagnosis",
-    `- META: ${report.hubOwned.meta.ok ? "ok" : `missing ${report.hubOwned.meta.missing.join(", ")}`}`,
-    ...stageLines,
-    ...report.secretsError ? [`- secrets UNVERIFIED (treated as not ready): ${report.secretsError}`] : [],
-    ...(report.edgeDomainWarnings ?? []).map(
-      (w) => `- \u26A0 edge domain does not resolve in DNS (advisory): ${w.stage} \u2192 ${w.host}; verify the registry edgeDomains value against the live public host`
-    ),
-    ...(report.runtimeSecretStreamWarnings ?? []).map(
-      (w) => `- \u26A0 required secrets provisioned but not in requiredRuntimeSecrets (advisory): ${w.stage} \u2192 ${w.names.join(", ")}; add them to the registry stream list or they will not be materialized into tenant.env`
-    ),
-    "",
-    "### Auto-heal applied / available",
-    ...opts.healed?.length ? opts.healed.map((x) => `- ${x}`) : report.autoHealAvailable.map((x) => `- ${x}`),
-    "",
-    "### App-owned implementation plan",
-    ...report.appOwnedGaps.map((x) => `- ${x}`),
-    end
-  ].join("\n");
-  const re = new RegExp(`${start}[\\s\\S]*?${end}`);
-  return re.test(existingBody) ? existingBody.replace(re, () => section) : `${existingBody.trim()}
-
-${section}`.trim();
-}
-
 // src/oauth.ts
 var DEFAULT_DOMAINS = ["mutatismutandis.co", "mutmut.co"];
 var DEFAULT_CALLBACK_PATH = "/api/auth/callback";
@@ -15718,7 +15245,7 @@ var ENV_PREFIXES = ["", "dev", "rc"];
 var LOOPBACK = ["http://localhost", "http://127.0.0.1"];
 var SSM_NAMES = ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"];
 var uniq = (xs) => [...new Set(xs)];
-function defaultSubdomain2(slug) {
+function defaultSubdomain(slug) {
   const i = slug.indexOf("-");
   return i === -1 ? slug : slug.slice(i + 1);
 }
@@ -15771,7 +15298,7 @@ function parseOauthConfig(mmiConfig, slug) {
     throw new Error("oauth must be an object when configured");
   }
   const raw = rawUnknown;
-  const subdomains = Array.isArray(raw.subdomains) && raw.subdomains.length > 0 ? raw.subdomains.map(String) : [defaultSubdomain2(slug)];
+  const subdomains = Array.isArray(raw.subdomains) && raw.subdomains.length > 0 ? raw.subdomains.map(String) : [defaultSubdomain(slug)];
   const domains = Array.isArray(raw.domains) && raw.domains.length > 0 ? raw.domains.map(String) : [...DEFAULT_DOMAINS];
   const callbackPath = typeof raw.callbackPath === "string" && raw.callbackPath ? raw.callbackPath : DEFAULT_CALLBACK_PATH;
   if (!callbackPath.startsWith("/")) {
@@ -15782,7 +15309,7 @@ function parseOauthConfig(mmiConfig, slug) {
   }
   const meta = mmiConfig ?? {};
   const rawFofuSub = raw.fofuSubdomain;
-  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain2(slug) : void 0;
+  const fofuSubdomain = meta.fofuEnabled === true ? typeof rawFofuSub === "string" ? rawFofuSub : defaultSubdomain(slug) : void 0;
   return { subdomains, domains, callbackPath, fofuSubdomain };
 }
 function probeRedirectUri(callbackPath, port = 9123) {
@@ -15810,6 +15337,26 @@ var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
 var SECRET_ENV_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
 var BUILD_SECRET_REF_RE = /^(?:[A-Z_][A-Z0-9_]*=)?(?:[A-Z_][A-Z0-9_]*|(?:mm-fofu|_org\/[a-z0-9][a-z0-9-]*):[A-Z_][A-Z0-9_]*|@github-packages-token)$/;
+function previewRegistryMetaMerge(existing, patch) {
+  const out = { ...existing ?? {} };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null) delete out[key];
+    else out[key] = value;
+  }
+  return out;
+}
+function boardLinkWriteError(patch, existing) {
+  const patchHasProjectId = typeof patch.projectId === "string" && patch.projectId.length > 0;
+  const patchHasProjectNumber = typeof patch.projectNumber === "number" && Number.isFinite(patch.projectNumber);
+  if (patchHasProjectId && !patchHasProjectNumber && existing?.projectNumber == null) {
+    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
+  }
+  const preview = previewRegistryMetaMerge(existing, patch);
+  if (patch.projectNumber === null && preview.projectId && preview.projectNumber == null) {
+    return "projectId requires projectNumber in registry META \u2014 pass projectNumber with board coords";
+  }
+  return null;
+}
 function parseSecretsCatalogVar(raw) {
   let parsed;
   try {
@@ -16321,17 +15868,44 @@ function buildSetDeployPatch(_slug, input) {
   };
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
+function filelessTransitionGuide(repo, stage) {
+  const authority = stage === "main" ? "Authority: main is master-admin only." : "Authority: a project-admin may complete this for their own repo; master may also do it.";
+  return [
+    `Fileless transition for ${repo} (${stage}):`,
+    `  ${authority}`,
+    `  mmi-cli org access role ${repo}`,
+    `  mmi-cli secrets list --repo ${repo}                         # names/capabilities only`,
+    `  mmi-cli secrets preflight --repo ${repo} --stage ${stage}`,
+    `  mmi-cli org project set-deploy ${repo} --stage ${stage} --no-env-file true`,
+    `  mmi-cli runtime tenant reconcile ${repo} ${stage} --watch`,
+    `  mmi-cli runtime tenant redeploy ${repo} ${stage} --watch`,
+    `  mmi-cli runtime tenant control ${repo} ${stage} verify-secrets --watch`,
+    `  mmi-cli runtime tenant control ${repo} ${stage} verify-broker --watch   # broker consumers`,
+    "  Missing/undeclared key (project-admin own project):",
+    `    mmi-cli secrets declare <KEY> --repo ${repo} --purpose "<purpose>" --group "<group>" --consumers runtime --stages ${stage}`,
+    `    mmi-cli secrets set ${stage}/<KEY> --repo ${repo}   # value from secure prompt/stdin; never argv/stdout`,
+    `    mmi-cli secrets request <KEY> --repo ${repo} --reason "wire requiredRuntimeSecrets for ${stage}"   # only if env injection needs master wiring`,
+    "  Runbook: https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/tenant-fileless-migration.md"
+  ].join("\n");
+}
 function composeDeclaresEnvFile(composeText) {
   return composeText.split(/\r?\n/).some((line) => /^\s*env_file\s*:/.test(line));
 }
 function composeHasRuntimeEnvLabel(composeText) {
-  return /mmi\.runtime-env/.test(composeText);
+  return composeText.split(/\r?\n/).some((raw) => {
+    const line = raw.replace(/(^|\s)#.*$/, "$1");
+    return /(^|[\s"'])mmi\.runtime-env\s*:\s*["']?true["']?\s*$/.test(line) || /mmi\.runtime-env\s*=\s*["']?true["']?\s*$/.test(line);
+  });
 }
 function evaluateFilelessComposeGuard(input) {
   if (input.force) return { ok: true, warn: `--force: skipping the fileless-compose guard for ${input.branch}` };
   if (input.composeText === null) {
-    return { ok: true, warn: `could not read docker-compose.yml on ${input.branch} \u2014 skipping the fileless-compose guard (run from the target repo checkout with the branch fetched to enable it)` };
+    return { ok: false, reason: `could not read docker-compose.yml on ${input.branch} \u2014 refusing to change noEnvFile without verifying the target branch compose. Run from the target repo checkout with origin/${input.branch} fetched, or use --force only after an independent verification.` };
   }
+  if (input.noEnvFile === false && composeHasRuntimeEnvLabel(input.composeText)) {
+    return { ok: false, reason: `the ${input.branch} branch marks a service mmi.runtime-env=true \u2014 setting noEnvFile=false would make the box take the legacy path and refuse this fileless compose (exit 78). Keep noEnvFile=true or land a verified legacy compose first.` };
+  }
+  if (input.noEnvFile === false) return { ok: true };
   if (composeDeclaresEnvFile(input.composeText)) {
     return {
       ok: false,
@@ -16393,15 +15967,16 @@ function evaluatePromotionFilelessGuard(input) {
     return {
       ok: false,
       reason: `the ${branch} docker-compose.yml marks a service fileless (mmi.runtime-env: "true") but DEPLOY#${stage}.noEnvFile is not true \u2014 the ${stage} deploy would fail exit-78 ("compose is fileless but DEPLOY#${stage} noEnvFile is not true"). Fix BEFORE promoting, then re-run:
-  mmi-cli org project set-deploy --stage ${stage} --no-env-file true   # register the fileless flag
-  gh workflow run tenant-reconcile.yml --repo mutmutco/MMI-Hub     # re-render the box control script (#1056)
-  (or pass --skip-compose-guard to override this preflight)`
+${filelessTransitionGuide(input.repo ?? "<owner/repo>", stage)}
+Override only after independent verification: --skip-compose-guard`
     };
   }
   if (noEnvFile && composeDeclaresEnvFile(input.composeText)) {
     return {
       ok: false,
-      reason: `DEPLOY#${stage}.noEnvFile is true but the ${branch} docker-compose.yml still declares env_file: \u2014 the box writes no .env, so docker compose dies on the missing file. Land the fileless compose (drop env_file:, add the mmi.runtime-env label) on ${branch}, or set-deploy --no-env-file false (or --skip-compose-guard to override).`
+      reason: `DEPLOY#${stage}.noEnvFile is true but the ${branch} docker-compose.yml still declares env_file: \u2014 the box writes no .env, so docker compose dies on the missing file. Land the fileless compose (drop env_file:, add the mmi.runtime-env label) on ${branch}.
+${filelessTransitionGuide(input.repo ?? "<owner/repo>", stage)}
+Rollback only after independent verification: set-deploy --no-env-file false; preflight override: --skip-compose-guard.`
     };
   }
   return { ok: true };
@@ -16490,6 +16065,27 @@ var import_node_fs17 = require("node:fs");
 var import_node_path15 = require("node:path");
 var import_node_os5 = require("node:os");
 
+// src/project-runtime.ts
+function hasRuntimeSecretContract(contract) {
+  if (!contract || typeof contract !== "object" || Array.isArray(contract)) return false;
+  return ["dev", "rc", "main"].some((stage) => Array.isArray(contract[stage]));
+}
+function projectRequiresGoogleOAuth(meta, model) {
+  if (!meta || model === "content" || model === "none" || meta.deployModel === "content" || meta.deployModel === "none" || meta.class === "content") return false;
+  const projectType = resolveProjectType(meta, meta.repos?.[0] ?? "");
+  return projectType === "web-app" && Boolean(meta.oauth && typeof meta.oauth === "object");
+}
+function edgeDomainsByStage(meta) {
+  const edgeDomains = meta?.edgeDomains;
+  if (!edgeDomains || typeof edgeDomains !== "object" || Array.isArray(edgeDomains)) return {};
+  const out = {};
+  for (const stage of ["dev", "rc", "main"]) {
+    const value = edgeDomains[stage];
+    if (typeof value === "string" && value.trim()) out[stage] = value.trim();
+  }
+  return out;
+}
+
 // src/secrets-diff.ts
 var TIMEOUT_MS2 = 8e3;
 var OWNER3 = "mutmutco";
@@ -16661,13 +16257,13 @@ async function withSecrets(run) {
   await run(makeSecretsDeps(cfg));
 }
 function registerSecretsCommands(program3) {
-  const secrets = program3.command("secrets").description("two-tier project secrets \u2014 self-serve your repo dev/* tier; org tier is master-gated");
+  const secrets = program3.command("secrets").description("project vault \u2014 project-admins self-serve their own repo's full tree (stageless + dev/rc/main); org-infra namespaces are master-gated");
   secrets.command("where").description("print where this repo's secrets live \u2014 the two-tier vault layout + well-known keys (no values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsWhere(d, o)));
   secrets.command("list").description("list secret NAMES + tier for this repo (never values)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsList(d, o)));
-  secrets.command("find <intent>").description("resolve a plain-language intent to the canonical secret(s) + the exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
+  secrets.command("find <intent>").description("resolve a plain-language intent to canonical secret names + the exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((intent, o) => withSecrets(async (d) => {
     if (!await secretsFind(d, intent, o)) process.exitCode = 1;
   }));
-  secrets.command("catalog").description("the secret catalog \u2014 grouped, with each secret's exact get command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--drift", "include the bidirectional reconciler drift report").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCatalog(d, o)));
+  secrets.command("catalog").description("the secret catalog \u2014 grouped, with each secret's exact keyless-use command (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--drift", "include the bidirectional reconciler drift report").option("--json", "machine-readable output").action((o) => withSecrets((d) => secretsCatalog(d, o)));
   secrets.command("doctor").description("vault drift report \u2014 declared-missing / orphan / off-scheme / duplicate (master-only, #2244)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((o) => withSecrets(async (d) => {
     if (!await secretsDoctor(d, o)) process.exitCode = 1;
   }));
@@ -16736,7 +16332,7 @@ function registerSecretsCommands(program3) {
       const facts = await fetchDeployFactsBySlug(slug, regDeps);
       const fact = facts?.stages?.[stage] ?? null;
       const composeText = sameRepo ? await readStageBranchCompose(branch) : null;
-      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo), force: false });
+      const verdict = evaluatePromotionFilelessGuard({ composeText, branch, stage, fact, sameRepo: Boolean(sameRepo), force: false, repo });
       if (!verdict.ok) {
         d.err(`secrets preflight: ${verdict.reason}`);
         filelessOk = false;
@@ -16778,7 +16374,7 @@ function registerSecretsCommands(program3) {
     if (!ok) process.exitCode = 1;
   });
   secrets.command("set <key>").description("write/rotate a secret; value from stdin (never an argument). DECLARE-FIRST (#2528): the key must be a declared catalog coordinate \u2014 bare <KEY> = the stageless canonical, <stage>/<KEY> = a declared per-stage override; undeclared writes are rejected with the fix").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(setHandler);
-  secrets.command("copy").description("copy provider keys between vault tiers (audit-logged; org-tier source is master-gated)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
+  secrets.command("copy").description("copy provider keys between stages in your own project vault (audit-logged; encryption keys blocked)").requiredOption("--from <stage>", "source tier: dev, rc, or main").requiredOption("--to <stage>", "destination tier: dev, rc, or main").requiredOption("--keys <names>", "comma-separated secret names (encryption keys blocked)").option("--dry-run", "report copies without writing").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((o) => withSecrets(async (d) => {
     const stages = ["dev", "rc", "main"];
     if (!stages.includes(o.from) || !stages.includes(o.to)) {
       return fail("secrets copy: --from and --to must be dev, rc, or main");
@@ -16818,13 +16414,13 @@ function registerSecretsCommands(program3) {
     );
     if (!ok) process.exitCode = 1;
   }));
-  secrets.command("rm <key>").description("remove a secret (project tier self-serve; org tier needs a grant)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
-  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: `use <key> -- <cmd>` injects it into the command env (never printed); a granted non-master can use an org secret. No command prints guidance only.").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
+  secrets.command("rm <key>").description("remove a secret from your own full project vault; org-infra requires master or an exact grant").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action((key, o) => withSecrets((d) => secretsRemove(d, key, o)));
+  secrets.command("use <key> [command...]").description("consume a secret KEYLESS: own-project full tree or an exactly granted org-infra key; injects into command env and never prints it").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").option("--name <ENVVAR>", "env var name to inject under (default: the key leaf, UPPER_SNAKE)").action((key, command, o) => withSecrets(async (d) => {
     const ok = await secretsUse(d, key, { ...o, command });
     if (ok === false) process.exitCode = 1;
   }));
-  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to a specific org-tier secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
-  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-tier secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to one specific org-infra secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
+  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
 
 // src/app-actor.ts
@@ -18603,7 +18199,7 @@ function registerBootstrapCommands(program3) {
     else console.log(renderOrgRulesetDriftReport(plan));
     if (plan.action !== "noop") process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").option("--class <class>", "deployable | content", "deployable").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -18919,12 +18515,12 @@ async function ensurePortRangeAtomic(repo, path2, allocate, opts = {}) {
 function shellFor(platform2 = process.platform) {
   return platform2 === "win32" ? "powershell" : "bash";
 }
-function isCentralContainerModel2(model) {
+function isCentralContainerModel(model) {
   return model === "tenant-container" || model === "solo-container";
 }
 function deriveStageGap(inputs) {
   const missing = [];
-  if (!isCentralContainerModel2(inputs.deployModel)) {
+  if (!isCentralContainerModel(inputs.deployModel)) {
     return `local stage default applies to central-container repos only (tenant-container/solo-container; registry deployModel = ${inputs.deployModel ?? "unset"})`;
   }
   if (!inputs.hasCompose) missing.push("docker-compose.yml");
@@ -19396,7 +18992,7 @@ function registerBoardCommands(program3) {
       expected: [...BOARD_STATUSES]
     });
   }
-  async function runBulkMove(issueRefs, o, status, failLabel) {
+  async function runBulkMove(issueRefs, o, status) {
     try {
       const bulk = await moveBoardIssues({
         config: await loadConfigForBoardSelector2(issueRefs[0], o.repo),
@@ -19414,7 +19010,7 @@ function registerBoardCommands(program3) {
       }
       if (bulk.failed > 0) process.exitCode = 1;
     } catch (e) {
-      return failGraceful(`${failLabel} failed: ${e.message}`);
+      return failGraceful(`board move failed: ${e.message}`);
     }
   }
   withExamples(mutating(
@@ -19436,7 +19032,7 @@ function registerBoardCommands(program3) {
       }
       return;
     }
-    await runBulkMove(issueRefs, o, canonicalStatus, "board move");
+    await runBulkMove(issueRefs, o, canonicalStatus);
   }), [
     'mmi-cli board move "In Progress" 2680',
     "mmi-cli board move Done 2680 2681 2682"
@@ -19469,19 +19065,6 @@ function registerBoardCommands(program3) {
       return failGraceful(`board set-priority failed: ${e.message}`);
     }
   });
-  mutating(board.command("done <issues...>").description("set one or more board items' Status to Done (does not close the GitHub issue; use `gh issue close`)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--allow-partial", "return success JSON if the item resolves but the status move fails")).action(async (issueRefs, o) => {
-    if (issueRefs.length === 1) {
-      try {
-        const result = await moveBoardItem({ config: await loadConfigForBoardSelector2(issueRefs[0], o.repo), selector: issueRefs[0], status: "Done", repo: o.repo, allowPartial: o.allowPartial });
-        if (o.json) return console.log(JSON.stringify(result));
-        console.log(result.partial ? `Partially moved ${result.item.ref}: ${result.warning}` : `Moved ${result.item.ref} -> Done`);
-      } catch (e) {
-        return failGraceful(`board done failed: ${e.message}`);
-      }
-      return;
-    }
-    await runBulkMove(issueRefs, o, "Done", "board done");
-  });
   board.command("unclaim <issue>").description("clear the assignee and reset the board Status (defaults to Todo) \u2014 the inverse of claim").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--to-status <status>", `set Status after unclaim (default Todo; one of ${BOARD_STATUSES.join(", ")})`).option("--allow-partial", "return success JSON if the assignee clear or status move fails").action(async (issueRef, o) => {
     const toStatus = o.toStatus ? resolveBoardStatus(o.toStatus) : void 0;
     try {
@@ -19986,7 +19569,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["worktree", "gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process10.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -21074,7 +20657,7 @@ function buildPluginGuardDecision(i) {
   if (!i.marketplaceClonePresent || !i.pluginCachePresent) return { state: "unresolved" };
   return { state: "healthy" };
 }
-function buildGuardSessionStartLine(state, opts = {}) {
+function buildPluginGuardLine(state, opts = {}) {
   if (state === "healthy" || state === "not-org") return { exitCode: 0 };
   const recovery = opts.recovery ?? "mmi-cli plugin heal";
   const restartHint = opts.restartHint ?? "restart your agent host / reload plugins";
@@ -21281,8 +20864,7 @@ async function applyPluginHeal(surface, log, opts) {
   }
   return true;
 }
-async function runGuard(opts = {}, readOrigin) {
-  void opts;
+async function runGuard(readOrigin) {
   try {
     const surface = detectSurface(process.env);
     if (surfaceToken(surface) !== "claude") {
@@ -21292,7 +20874,7 @@ async function runGuard(opts = {}, readOrigin) {
     const isOrgRepo = readOrigin ? await isOrgRepoRoot(readOrigin) : await isOrgRepoRoot();
     const input = snapshotPluginGuardInput(surface, isOrgRepo);
     const { state } = buildPluginGuardDecision(input);
-    const { line, exitCode } = buildGuardSessionStartLine(state);
+    const { line, exitCode } = buildPluginGuardLine(state);
     if (line) console.error(line);
     process.exitCode = exitCode;
   } catch {
@@ -21448,7 +21030,7 @@ function formatDeployStatus(r) {
 }
 
 // src/deploy-commands.ts
-var STAGES2 = ["dev", "rc", "main"];
+var STAGES = ["dev", "rc", "main"];
 async function probeHttpBounded(url, timeoutMs = 5e3) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -21465,7 +21047,7 @@ async function probeHttpBounded(url, timeoutMs = 5e3) {
 function registerDeployCommands(program3) {
   const deploy = program3.command("deploy").description("per-stage deploy observability \u2014 last run, health, and running version (#2688)");
   deploy.command("status <stage>").description("last deploy run + runtime health probe + running version for a stage (defaults to the current repo)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (stage, o) => {
-    if (!STAGES2.includes(stage)) {
+    if (!STAGES.includes(stage)) {
       return fail(`runtime deploy status: <stage> must be dev, rc, or main`);
     }
     try {
@@ -23026,7 +22608,7 @@ rules.command("gitignore").option("--write", "upsert the managed block into .git
     console.log("mmi-cli org rules gitignore: up to date");
   }
 });
-program2.command("commands").description("print the grouped agentic-coding map; use --all for operational depth").option("--all", "include operational, internal, compatibility, and delegated depth").option("--json", "machine-readable command manifest").option("--primary", "with --json, emit only the compact primary tree and index").action((o) => {
+program2.command("commands").description("print the grouped agentic-coding map; use --all for operational depth").option("--all", "include operational and internal depth").option("--json", "machine-readable command manifest").option("--primary", "with --json, emit only the compact primary tree and index").action((o) => {
   const manifest = buildCommandManifest(program2);
   if (o.json) {
     consoleIo.log(JSON.stringify(o.primary ? primaryCommandManifest(manifest) : manifest, null, 2));
@@ -23468,7 +23050,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("run bounded service control (status/start/stop/restart, rc-only retire, read-only verify-secrets) for a tenant via the central tenant-control.yml workflow; project-admin dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets watch by default)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker watch by default)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch });
     if (!o.json && action === "verify-secrets" && result.secrets) {
@@ -23476,6 +23058,10 @@ tenant.command("control <owner/repo> <stage> <action>").description("run bounded
       const { lines, failure } = renderVerifySecrets(body);
       for (const line of lines) printLine(line);
       if (failure) return failGraceful(`runtime tenant control ${stage} verify-secrets: ${failure}`);
+    } else if (!o.json && action === "verify-broker" && result.broker) {
+      const { lines, failure } = renderVerifyBroker({ broker: result.broker, raw: result.brokerRaw });
+      for (const line of lines) printLine(line);
+      if (failure) return failGraceful(`runtime tenant control ${stage} verify-broker: ${failure}`);
     } else {
       printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
     }
@@ -23486,6 +23072,15 @@ tenant.command("control <owner/repo> <stage> <action>").description("run bounded
     return failGraceful(`runtime tenant control: ${e.message}`);
   }
 });
+tenant.command("reconcile <owner/repo> <stage>").description("re-render this tenant stage's generated box assets from registry truth; project-admin own dev/rc, master main; watches by default").option("--watch", "wait for the tenant-reconcile.yml run (default)").option("--no-watch", "return after dispatch; do not redeploy until the reconcile run succeeds").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+  try {
+    const result = await runTenantReconcile(trainApplyDeps(), { repo, stage, watch: o.watch });
+    printLine(o.json ? JSON.stringify(result, null, 2) : `${result.note}${result.runUrl ? ` \u2014 ${result.runUrl}` : ""}`);
+    if (result.conclusion === "failure" || !result.dispatched) process.exitCode = 1;
+  } catch (e) {
+    return failGraceful(`runtime tenant reconcile: ${e.message}`);
+  }
+});
 tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints").action(async (repo, stage) => {
   if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
   const cfg = await loadConfig();
@@ -23527,14 +23122,6 @@ tenant.command("sweep-rc").description("discover (and optionally retire) running
     return failGraceful(`runtime tenant sweep-rc: ${e.message}`);
   }
 });
-async function resolveDnsBounded(host, timeoutMs = 3e3) {
-  const { lookup } = await import("node:dns/promises");
-  const probe = lookup(host).then(() => true).catch((e) => dnsErrorToResolution(e?.code));
-  const timeout = new Promise((resolve5) => {
-    setTimeout(() => resolve5(void 0), timeoutMs).unref?.();
-  });
-  return Promise.race([probe, timeout]);
-}
 async function probeHttpBounded2(url, timeoutMs = 5e3) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -23565,68 +23152,7 @@ async function buildTenantRuntimeStatusFor(target, stage, cfg) {
     lastTenantDeployRun: (await fetchLastTenantDeployRun(slug, stage)).run
   });
 }
-async function v2ReadinessDeps(cfg) {
-  const reg = registryClientDeps(cfg);
-  return {
-    resolveDns: (host) => resolveDnsBounded(host),
-    // Checked read (#727/#733): the doctor distinguishes a FAILED read (degraded report) from a 404.
-    getProject: (slug) => fetchProjectBySlugChecked(slug, reg),
-    hasDeployCoords: async (slug, stage) => {
-      const status = await fetchDeployStatusBySlug(slug, reg);
-      return Boolean(status?.stages[stage]);
-    },
-    hasDeployState: async (slug, stage) => {
-      const status = await fetchDeployStatusBySlug(slug, reg);
-      return Boolean(status?.deployState[stage]);
-    },
-    getDeployFact: async (slug, stage) => {
-      const facts = await fetchDeployFactsBySlug(slug, reg);
-      const fact = facts?.stages[stage];
-      return fact ? { port: fact.port, domain: fact.domain } : null;
-    },
-    listSecrets: async (targetRepo2) => {
-      const apiUrl = cfg.sagaApiUrl;
-      if (!apiUrl) throw new Error("Hub API URL not configured \u2014 cannot verify secret names (set sagaApiUrl)");
-      const qs = new URLSearchParams({ repo: targetRepo2 }).toString();
-      const res = await fetchWithRetry(fetch, `${apiUrl.replace(/\/$/, "")}/secrets/list?${qs}`, {
-        method: "GET",
-        headers: await hubHeaders()
-      }, { attempts: 2, timeoutMs: 5e3 });
-      if (!res.ok) throw new Error(`secrets list failed for ${targetRepo2}: HTTP ${res.status}`);
-      const body = await res.json();
-      return (body.secrets ?? []).map((s) => s.key).filter(Boolean);
-    }
-  };
-}
-async function updateV2ReadinessIssue(repo, report, healed) {
-  const title = "v2 readiness: central deploy + secrets alignment";
-  const freshBody = renderReadinessIssueBody("", report, { healed });
-  const list = await execFileP2("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
-  const issues = JSON.parse(list.stdout || "[]");
-  const existing = issues.find((i) => i.title.toLowerCase().includes("v2 readiness"));
-  if (!existing) {
-    const create = await bodyArgsViaFile(["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"]);
-    try {
-      const created = await execFileP2("gh", create.args, { timeout: GH_MUTATION_TIMEOUT_MS });
-      const url = created.stdout.trim();
-      const number = Number(url.match(/\/issues\/(\d+)$/)?.[1] ?? 0);
-      return { number, url, action: "created" };
-    } finally {
-      await create.cleanup();
-    }
-  }
-  const view = await execFileP2("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
-  const current = JSON.parse(view.stdout || "{}");
-  const nextBody = renderReadinessIssueBody(current.body ?? "", report, { healed });
-  const edit = await bodyArgsViaFile(["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody]);
-  try {
-    await execFileP2("gh", edit.args, { timeout: GH_MUTATION_TIMEOUT_MS });
-  } finally {
-    await edit.cleanup();
-  }
-  return { number: existing.number, url: current.url ?? `https://github.com/${repo}/issues/${existing.number}`, action: "updated" };
-}
-var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); attest is project-admin; set is master-only");
+var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
@@ -23686,69 +23212,7 @@ projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# fa
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload));
 });
-project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `org project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("org project doctor", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const report = await buildV2Doctor(target, await v2ReadinessDeps(cfg));
-  console.log(JSON.stringify(report));
-  if (!report.ok) process.exitCode = 1;
-});
-project.command("heal [owner/repo]").description("repair Hub-owned v2 readiness state only; never product repo files; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--apply", "apply the Hub-owned registry patch").option("--json", "machine-readable output").action(async (repo, o) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("org project heal", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const reg = registryClientDeps(cfg);
-  const out = await runV2Heal(target, { apply: o.apply }, {
-    fetchProject: (s) => fetchProjectBySlugChecked(s, reg),
-    upsertProject: (s, patch) => upsertProject(s, patch, reg)
-  });
-  if (out.status === "aborted") return failGraceful(`org project heal: ${out.error}`);
-  if (out.status === "planned") {
-    console.log(JSON.stringify({ ok: true, slug: out.slug, dryRun: true, patch: out.patch, appOwnedGaps: out.appOwnedGaps }));
-    return;
-  }
-  if (out.status === "noop") {
-    console.log(JSON.stringify({ ok: true, slug: out.slug, applied: [], appOwnedGaps: out.appOwnedGaps }));
-    return;
-  }
-  if (out.status === "write-failed") return reportWrite("org project heal", out.write);
-  console.log(JSON.stringify({ ok: true, slug: out.slug, applied: out.applied, appOwnedGaps: out.appOwnedGaps, result: out.result }));
-});
-project.command("readiness [owner/repo]").description("update the repo v2 readiness issue with Hub diagnosis and app-owned tasks; defaults to the current repo").option("--update-issue", "create/update the bounded v2 readiness issue section").option("--json", "machine-readable output").action(async (repo, o) => {
-  if (!o.updateIssue) return fail("org project readiness: pass --update-issue");
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("org project readiness", repo);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const report = await buildV2Doctor(target, await v2ReadinessDeps(cfg));
-  const issue2 = await updateV2ReadinessIssue(target, report, []);
-  console.log(JSON.stringify({ ok: true, repo: target, issue: issue2, ready: report.ok }));
-});
-project.command("attest [owner/repo]").description("attest this repo's app-owned v2 readiness work is done (project-admin of the repo or master) \u2014 clears doctor's static appOwnedGaps; re-running overwrites; defaults to the current repo").option("--json", "machine-readable output").action(async (repoOrSlug) => {
-  const cfg = await loadConfig();
-  let target;
-  try {
-    target = await projectTarget("org project attest", repoOrSlug);
-  } catch (e) {
-    return fail(e.message);
-  }
-  const repo = target.includes("/") ? target : `mutmutco/${slugOf(target)}`;
-  const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
-  return reportWrite("org project attest", res);
-});
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", "read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (clear all with --unset secrets)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -23862,7 +23326,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage> Hetzner deploy coords for a tenant (master-only) \u2014 omitted flags keep their stored value; seeds a freshly-bootstrapped tenant; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 true = #2662 env passthrough, no .env symlink; omit to leave the row unchanged").option("--force", "skip the #2748 fileless-compose guard (flip noEnvFile=true even if the stage branch compose still declares env_file:)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").requiredOption("--stage <stage>", "dev | rc | main").option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").option("--substrate <substrate>", "hetzner-ssh; omit to leave the row unchanged").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -23876,17 +23340,23 @@ project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage>
     if (v !== "true" && v !== "false") return fail("org project set-deploy: --no-env-file must be true or false");
     noEnvFile = v === "true";
   }
-  if (noEnvFile === true) {
+  if (noEnvFile !== void 0) {
     const branch = DEPLOY_STAGE_BRANCH[o.stage.trim().toLowerCase()];
     if (branch) {
       const cwdRepo = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]).catch(() => ""));
       const sameRepo = !repoOrSlug || Boolean(cwdRepo) && (repoOrSlug.includes("/") ? cwdRepo.toLowerCase() === target.toLowerCase() : slugOf(cwdRepo) === slugOf(target));
       if (sameRepo) {
-        const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force) });
-        if (!verdict.ok) return fail(`org project set-deploy: ${verdict.reason}`);
+        const verdict = evaluateFilelessComposeGuard({ composeText: await readStageBranchCompose(branch), branch, force: Boolean(o.force), noEnvFile });
+        if (!verdict.ok) return fail(`org project set-deploy: ${verdict.reason}
+${filelessTransitionGuide(target, o.stage)}`);
         if (verdict.warn) console.error(`org project set-deploy: ${verdict.warn}`);
+      } else if (!o.force) {
+        return fail(
+          `org project set-deploy: cannot verify ${target} ${branch} from this checkout \u2014 refusing to change noEnvFile. Run from the target repo with origin/${branch} fetched.
+${filelessTransitionGuide(target, o.stage)}`
+        );
       } else {
-        console.error(`org project set-deploy: --no-env-file guard skipped \u2014 run from the ${target} checkout to verify the ${branch} branch compose (#2748).`);
+        console.error(`org project set-deploy: --force: skipping cross-repo fileless-compose verification for ${target} ${branch}.`);
       }
     }
   }
@@ -23906,6 +23376,7 @@ project.command("set-deploy [owner/repo]").description("patch the DEPLOY#<stage>
       clearAliases: o.clearAliases,
       noEnvFile
     });
+    if (target.includes("/")) body.repo = target;
   } catch (e) {
     return fail(e.message);
   }
@@ -24753,6 +24224,12 @@ function trainApplyDeps() {
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
     },
+    dispatchTenantReconcile: async ({ repo, stage }) => {
+      const res = await tenantReconcile({ repo, stage }, registryClientDeps(await loadConfig()));
+      if (res.ok) return { ok: true };
+      const body = res.body;
+      return { ok: false, category: body?.category, error: body?.error ?? res.error };
+    },
     // Hotfix-coverage guard (#958): runs against the local clone via real git. manifestPaths exempts the
     // release version fold (#976) — a main-only commit touching ONLY the root package manifest is the
     // fold's version metadata, which the candidate replaces with its own. (The Hub's wider distribution
@@ -25026,7 +24503,7 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
     mmiDoctorDeps()
   );
 });
-program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
+program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk").action(() => runGuard());
 program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
 function directoryBytes(path2) {
   let total = 0;
@@ -25170,18 +24647,9 @@ program2.command("session-start").description("run the SessionStart verbs (whoam
   appendHookActivity(process.cwd(), { event: "SessionStart", script: "session-start", outcome: "ran", action: "session-start hook completed" });
 });
 installProcessBackstop();
-program2.command("lane", { hidden: true }).action(() => {
-  fail("lane orchestration lives in jerv-cli \u2014 try: jerv-cli lane --help");
-});
-program2.command("fusion", { hidden: true }).action(() => {
-  fail("fusion orchestration lives in jerv-cli \u2014 try: jerv-cli fusion --help");
-});
 consolidateCommandNamespaces(program2);
 applyCommandTaxonomy(program2);
-var rewrittenArgv = rewriteLegacyArgv(process.argv);
-if (rewrittenArgv.warning) process.stderr.write(`${rewrittenArgv.warning}
-`);
-program2.parseAsync(rewrittenArgv.argv).then(() => finishCliRun()).catch((e) => failGraceful(e.message));
+program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGraceful(e.message));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_PRIORITY,